You can only verify that the software is doing what it is supposed to do by analyzing the resultant binary. And, analyzing the resultant binary can be done with

You can only verify that the software is doing what it is supposed to do by analyzing the resultant binary. And, analyzing the resultant binary can be done with or without the source code. In fact, many security researchers work exclusively on software (often Microsoft Windows) for which they will never be able to see the source code. http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html